aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +127 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.21.3)

pymdown-extensions PYPI version 10.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - aiagents4pharma =0.0.0, =0.1.0, =0.5.0a1, =0.1.0, =3.8.0, =0.1.0, =2025.9.131446, =0.2.0b1, =1.0.4, =0.1.0, =0.2.1 and mor...

open-webui (>=0.5.17, <=0.6.5), open-webui-steve (0.6.5.45) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.14.2)

pymdown-extensions PYPI version 10.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.5.17, =0.6.5 - open-webui-steve 0.6.5.45 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-61632 Source...

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...

arkindex-base-worker (>=0.3.1b1, <=0.3.1rc2), labext-pkg (2.2.0) +3 more potentially affected by CVE-2026-61632 via pymdown-extensions (9.5.0)

pymdown-extensions PYPI version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.1b1, =0.0.4, =0.0.130, =2023.11.4 - stuffpages 0.7.4 Source cves: CVE-2026-61632 Source advisory:...

arkindex-base-worker (>=0.3.5rc6, <=0.3.6rc5), mkdocs-techdocs-core (>=1.3.2, <=1.5.0) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.3.1)

pymdown-extensions PYPI version 10.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.5rc6, =1.3.2, =1.5.0 - mkdocs-techdocs-core-alexef 1.4.0 Source cves: CVE-2026-61632 Source...

open-webui (>=0.8.0, <=0.8.8) potentially affected by CVE-2026-61632 via pymdown-extensions (10.20.1)

pymdown-extensions PYPI version 10.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.8.0, =0.8.8 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

arkindex-base-worker (>=0.3.5rc1, <=0.3.5rc5), saasops (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-61632 via pymdown-extensions (10.3.0)

pymdown-extensions PYPI version 10.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.5rc1, =0.1.0, =0.1.1 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

docwriter (>=0.1.0, <=0.3.1) potentially affected by CVE-2026-61632 via pymdown-extensions (4.11.0)

pymdown-extensions PYPI version 4.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - docwriter =0.1.0, =0.3.1 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

GHSA-9XWG-3R6F-JCX2 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...

arkindex-base-worker (>=0.3.1rc3, <=0.3.1rc4) potentially affected by CVE-2026-61632 via pymdown-extensions (9.6.0)

pymdown-extensions PYPI version 9.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.1rc3, =0.3.1rc4 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

blog-vi (0.2.6), django-apirouter (>=0.1.0, <=0.2.1) +5 more potentially affected by CVE-2026-61632 via pymdown-extensions (7.1.0)

pymdown-extensions PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - blog-vi 0.2.6 - django-apirouter =0.1.0, =2.1.0, =0.0.4, =0.10.2, =1.4.0, =1.7.0 Source cves: CVE-2026-61632 Source advisory...

mkdocs-meta-descriptions-plugin (>=0.0.3, <=0.0.4) potentially affected by CVE-2026-61632 via pymdown-extensions (8.1.1)

pymdown-extensions PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-meta-descriptions-plugin =0.0.3, =0.0.4 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

CVE-2026-46338

A flaw was found in PyMdown Extensions, a tool used for processing Markdown documents. This vulnerability allows an attacker to potentially read sensitive files from unexpected locations on a system. By crafting a special Markdown snippet, an attacker could trick the system into accessing files...

Linux Distros Unpatched Vulnerability : CVE-2023-32309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In affected versions an arbitrary file read is possible when using include...

Linux Distros Unpatched Vulnerability : CVE-2026-46338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containmen...

CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

UBUNTU-CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

CVE-2026-46338

PyMdown Extensions (pymdownx.snippets) contains a regression that reintroduces a sibling-prefix path traversal when restrict_base_path is True. From 10.0.1 through 10.21.2, get_snippet_path uses a string-prefix check (filename.startswith(base)) that can read files from sibling paths sharing the s...

CVE-2026-46338 PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...